Hi Mark, On Thu, Sep 17, 2026 at 08:53:18AM +0200, Salvatore Bonaccorso wrote: > Hi, > > On Thu, Sep 17, 2026 at 08:52:13AM +0200, Salvatore Bonaccorso wrote: > > Hi Mark, > > > > On Sun, Sep 06, 2026 at 09:02:48PM +0200, Salvatore Bonaccorso wrote: > > > Source: zlib > > > Version: 1:1.3.dfsg+really1.3.2-1 > > > Severity: grave > > > Tags: security upstream > > > Justification: user security hole > > > X-Debbugs-Cc: [email protected], Debian Security Team > > > <[email protected]> > > > > > > Hi, > > > > > > The following vulnerability was published for zlib. > > > > > > CVE-2026-85091[0]: > > > | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow > > > | vulnerability in the gz_vacate() function when processing non- > > > | blocking gzwrite() operations with stale external buffer pointers. > > > | Attackers can trigger the overflow by calling gzprintf() or > > > | gzvprintf() after a write stall, causing an unchecked memmove() to > > > | write beyond the internal input buffer boundary. > > > > > > > > > If you fix the vulnerability please also make sure to include the > > > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > > > Attached is a proposed update for zlib in unstable with one related > > patch cherry-picked and the upstream commited change for > > CVE-2026-85091. > > And now attached for real :-(
Are you okay with if I upload this NMU to proceed with the fix in usntable, and we (me for trixie, and Tobias is doing bookworm and older), to address the issue? Regards, Salvatore
